feat: unified group management, public groups, and activity-based sidebar

Create Group wizard (Electron-only) consolidates 6 steps across 4 interfaces
into a single multi-step page: group creation on hub, node attachment, root
selection via folder picker, GEK initialization, and auto-pairing — all in one
flow. Browser SPA keeps its current behavior unchanged.

Public group support (Option A — GEK for all groups):
- All groups have GEK regardless of visibility; open-join groups auto-admit
  via TOFU when join_policy is "open"
- Key rotation blocked for public groups (API guard + UI hidden)
- Hub signaling allows WebRTC offers for nodes hosting open-join groups even
  when the caller isn't a member yet
- attach_group writes join_policy to node.toml
- Daemon loads GEK for all groups, not just private ones
- Known-device path in join_request now auto-admits to open-join groups

Node loopback API bridge (Electron IPC):
- node:detect, node:call, node:pairing-code IPC handlers in main process
- Renderer never sees tokens, paths, or keys (session token = physical access)
- platform.js node namespace for UI consumption
- Loopback endpoints: roots CRUD, member-upload toggle, reload

Bug fixes:
- Root change detection: removed premature ctx["roots"] updates from add_root
  and remove_root that prevented indexer retarget on reload
- Duplicate offline message: global fallback now gated on !group
- Signaling membership check: fallback to open-join groups for non-members

Sidebar groups sorted by last_activity_at (most recent first):
- New Group.last_activity_at column with Alembic migration
- POST /v1/groups/{id}/activity endpoint, called on connect and chat send
- Client-side sort + throttled hub updates (1/min)

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

1 files changed, 22 insertions, 10 deletions

diff --git a/packages/meshbay-node/src/meshbay_node/daemon.py b/packages/meshbay-node/src/meshbay_node/daemon.py
index 7e3ebc1..385a1da 100644
--- a/packages/meshbay-node/src/meshbay_node/daemon.py
+++ b/packages/meshbay-node/src/meshbay_node/daemon.py
@@ -125,6 +125,7 @@ class NodeDaemon:
         self._indexers: list[DirectoryIndexer] = []
         self._tasks: list[asyncio.Task] = []
         self._hub: HubClient | None = None
+        self._reload_lock = asyncio.Lock()
 
     async def run(self) -> None:
         log.info("MeshBay Node starting up")
@@ -225,14 +226,13 @@ class NodeDaemon:
                         ", ".join(str(r.path) for r in roots))
 
                 gek = None
-                if group_cfg.visibility == "private":
-                    gek = await self._load_gek(
-                        group_cfg.id, session.user_id, sk_x_raw, pk_x_raw)
-                    if gek:
-                        log.info("GEK loaded for group %s", group_cfg.id[:8])
-                    else:
-                        log.info("No GEK yet for group %s — will accept first setup",
-                                 group_cfg.name)
+                gek = await self._load_gek(
+                    group_cfg.id, session.user_id, sk_x_raw, pk_x_raw)
+                if gek:
+                    log.info("GEK loaded for group %s", group_cfg.id[:8])
+                else:
+                    log.info("No GEK yet for group %s — will accept first setup",
+                             group_cfg.name)
 
                 indexer = DirectoryIndexer(
                     roots=roots,
@@ -399,7 +399,7 @@ class NodeDaemon:
                 on_incoming=on_incoming,
                 on_revocation=on_revocation,
                 on_webrtc_offer=on_webrtc_offer,
-                group_ids=list(groups_ctx.keys()),
+                group_ids=lambda: list((self._state.get("groups_ctx") or {}).keys()),
             ))
             self._tasks.append(ws_task)
             log.info("Hub WS task started")
@@ -470,7 +470,15 @@ class NodeDaemon:
         Handles root changes on existing groups, hot-loads new groups, and
         tears down removed groups. Existing connections are untouched: a member
         watching a film keeps watching it.
+
+        Serialised by _reload_lock: fire-and-forget reloads from config-mutating
+        endpoints can overlap with the wizard's explicit /api/reload call,
+        and two concurrent hot-loads of the same group corrupt the runtime state.
         """
+        async with self._reload_lock:
+            await self._reload_config_inner()
+
+    async def _reload_config_inner(self) -> None:
         log.info("Reloading config from %s", self._config_path)
         try:
             fresh = load_config(self._config_path)
@@ -537,7 +545,7 @@ class NodeDaemon:
             roots.refresh_availability()
 
             gek = None
-            if group_cfg.visibility == "private" and sk_x_raw and pk_x_raw:
+            if sk_x_raw and pk_x_raw:
                 gek = await self._load_gek(
                     group_cfg.id, node_user_id, sk_x_raw, pk_x_raw)
                 if gek:
@@ -616,6 +624,10 @@ class NodeDaemon:
         log.info("Reload complete — %d re-rooted, %d added, %d removed",
                  changed, len(added_names), len(removed_names))
 
+        if (added_names or removed_names) and self._hub:
+            gids = list((self._state.get("groups_ctx") or {}).keys())
+            await self._hub.update_ws_groups(gids)
+
     async def _login_with_retry(self, hub: HubClient):
         """Login to hub, retrying if the node key hasn't been linked yet."""
         import httpx as _httpx